CODE4UTECH HMS API Documentation
"Your Hospital. Your Experience. Our Backend."
Complete reference documentation for integrating custom patient mobile apps, self-service kiosks, waiting room LED displays, clinic booking portals, and doctor panels using secure medical REST APIs.
1. Authentication & Authorization Headers
All API requests require a valid Bearer token provided in the Authorization header and a target hospital identifier provided in the X-Hospital-Id header. Query parameter tokens (e.g. ?api_key=) are strictly rejected for security.
2. Granular Permission Scopes
A developer application can only access data authorized by the specific hospital administrator in their portal:
Query doctor profiles, specializations, schedules, and OPD fees.
Search patient demographics, register new patients, generate UHIDs.
Book clinic visits, confirm time slots, process cancellation requests.
Live token counts, TV LED display feeds, call next token, complete visits.
Access digital prescription medications, dosages, and QR verification URLs.
Record registration and consultation fee payments.
3. Doctors API
GET /api/v1/doctorscurl -X GET "https://hms.code4utech.com/api/v1/doctors" \ -H "Authorization: Bearer c4h_live_9f8e7d6c5b4a3..." \ -H "X-Hospital-Id: apex-hospital-delhi"
<?php
$ch = curl_init("https://hms.code4utech.com/api/v1/doctors");
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer c4h_live_9f8e7d6c5b4a3...",
"X-Hospital-Id: apex-hospital-delhi",
],
]);
$response = json_decode(curl_exec($ch), true);
print_r($response['data']);
const response = await fetch("https://hms.code4utech.com/api/v1/doctors", {
headers: {
"Authorization": "Bearer c4h_live_9f8e7d6c5b4a3...",
"X-Hospital-Id": "apex-hospital-delhi"
}
});
const { data } = await response.json();
console.log(data);
4. Patients API
POST /api/v1/patientscurl -X POST "https://hms.code4utech.com/api/v1/patients" \
-H "Authorization: Bearer c4h_live_9f8e7d6c5b4a3..." \
-H "X-Hospital-Id: apex-hospital-delhi" \
-H "Content-Type: application/json" \
-d '{
"name": "Rahul Verma",
"mobile": "+91 9876543210",
"gender": "male",
"age_years": 32,
"blood_group": "B+"
}'
5. Book Appointment API
POST /api/v1/appointmentscurl -X POST "https://hms.code4utech.com/api/v1/appointments" \
-H "Authorization: Bearer c4h_live_9f8e7d6c5b4a3..." \
-H "X-Hospital-Id: apex-hospital-delhi" \
-H "Content-Type: application/json" \
-d '{
"doctor_id": 4,
"patient_name": "Rahul Verma",
"patient_mobile": "+91 9876543210",
"appointment_date": "2026-08-25",
"appointment_time": "10:30",
"source": "api"
}'
6. Webhook Signature Verification (HMAC-SHA256)
Validate the incoming X-CODE4UTECH-Signature header on your webhook receiver endpoint:
<?php
$payload = file_get_contents('php://input');
$signatureHeader = $_SERVER['HTTP_X_CODE4UTECH_SIGNATURE'] ?? '';
$secretKey = 'whsec_xxxxxxxxxxxx';
$expectedSignature = hash_hmac('sha256', $payload, $secretKey);
if (!hash_equals($expectedSignature, $signatureHeader)) {
http_response_code(401);
die('Invalid signature');
}
$event = json_decode($payload, true);
// Process event: $event['event'], $event['data']
7. Error Responses & Codes
Missing or invalid Bearer token in Authorization header.
Developer subscription (₹899/mo) is inactive or expired.
Developer KYC is not yet approved by compliance team.
Target hospital has not approved this developer application.
Need Developer Architecture Assistance?
Our engineering team helps you integrate kiosks, mobile apps, and custom frontends.